# Redis

> Redis in-memory store tested for unauth access, version flaws, and keyspace secrets. Exploits include RCE via file writes, SSH key injection, cron abuse, auth bypass, and SSRF for lateral movement

- **URL:** https://hackindex.io/services/redis
- **Type:** Service
- **Default ports:** 6379
- **Tags:** redis, database, key-value, in-memory, nosql, network
- **Published:** 2025-12-31
- **Updated:** 2026-07-13

Redis is an in-memory key-value data store running on **TCP port 6379**. Nmap identifies it as `redis`. Redis is used for caching, session storage, message queues, and as a lightweight database in web application stacks.

Redis has no authentication enabled by default. An unauthenticated instance allows full read and write access to all stored data, which may include session tokens, cached credentials, and application secrets. Redis can also write arbitrary files to disk using the `CONFIG SET dir` and `CONFIG SET dbfilename` commands, enabling SSH key injection, crontab modification, or webshell placement.

Connect with `redis-cli` and run `INFO` to check the server version, OS, and configuration. Enumerate keys with `KEYS *` and inspect their contents. Test file write capabilities through `CONFIG SET`. If authentication is enabled, try common passwords or brute-force with `hydra`. Nmap's `redis-info` script handles initial enumeration.

## Phases

- [Enumeration](https://hackindex.io/services/redis/enumeration.md): Redis auth, version, keyspace, and secrets via nmap and redis-cli (1 guides)
- [Exploitation](https://hackindex.io/services/redis/exploitation.md): RCE, auth bypass, SSRF, and shell writes against Redis (9 guides)
- [Privilege Escalation](https://hackindex.io/services/redis/privilege-escalation.md): Escalate via Redis file writes to SUID, SSH keys, or cron paths (1 guides)
- [Persistence](https://hackindex.io/services/redis/persistence.md): Write SSH keys, cron jobs, or webshells via Redis config (1 guides)